俠客系統修改器1.21

俠客系統修改器1.21破解手記--演算法分析
作者：newlaos[CCG][DFCG]

軟體名稱：俠客系統修改器1.21(系統設定)
最新版本：1.21
檔案大小：604KB
軟體授權：共享軟體
使用平臺：Win9x/Me/NT/
釋出公司："http://xksoft.yeah.net"
軟體簡介：Windows 9x/NT 系統中有很多登錄檔選項沒有直接提供設定介面，如開始選單項的彈出速度，桌面上系統圖示的隱藏，系統安全屬性設定等等。當我們需要修改這些選項的時候，就要使用Windows 登錄檔編輯器來手工修改登錄檔資訊，這樣做不僅很麻煩，而且不安全，還需要一定的登錄檔知識。為了方便大家修改登錄檔選項，我編寫了這個系統設定修改器，可輕鬆修改Windows 系統中大部分登錄檔選項，還可以對一些非登錄檔選項進行設定（如IE4支援的資料夾圖示，電腦啟動選項等）。

加密方式：註冊碼
功能限制：未註冊資訊提示
PJ工具：TRW20001.23註冊版，W32Dasm8.93黃金版，FI2.5，eXeScope6.30
PJ日期：2003-04-20
作者newlaos申明：只是學習，請不用於商業用途或是將本文方法制作的序號產生器任意傳播，造成後果，本人一概不負。

1、先用FI2.5看一下主檔案“SysSet.exe”，沒加殼。程式是用VC++6.0編的

2、用W32Dasm8.93黃金版對SysSet.exe進行靜態反彙編，再用串式資料參考，找不到什麼經典的句子，怎麼辦？先用eXeScope6.30對檔案的資源進行分析，在“資源\字串表\1”，可以看見：
136," 非常感謝您對本軟體的支援!!!$0A再也不會有註冊提示對話方塊出現了，預祝您用的開心。"
137,您的註冊姓名與註冊碼不匹配，請檢查一下重新輸入。

再回到W32Dasm8.93，找到"String Resource ID=00137: "?
9M骼"(註冊失敗)，雙擊來到下面程式碼段。

3、再用TRW20001.23註冊版進行動態跟蹤，下斷BPX 004240E8(通常在註冊成功與否的前面一些下斷，這樣，才能找到關鍵部分)，
先輸入註冊名：newlaos
假碼: 78787878

.......
.......
:004240E8 51 push ecx
:004240E9 8D6E5C lea ebp, dword ptr [esi+5C]
:004240EC 8BCC mov ecx, esp
:004240EE 89642420 mov dword ptr [esp+20], esp
:004240F2 55 push ebp
:004240F3 E8CD5A0200 call 00449BC5
:004240F8 51 push ecx
:004240F9 8D7E60 lea edi, dword ptr [esi+60]
:004240FC 8BCC mov ecx, esp
:004240FE 89642428 mov dword ptr [esp+28], esp
:00424102 57 push edi
:00424103 C784249001000000000000 mov dword ptr [esp+00000190], 00000000
:0042410E E8B25A0200 call 00449BC5
:00424113 83CBFF or ebx, FFFFFFFF
:00424116 899C248C010000 mov dword ptr [esp+0000018C], ebx
:0042411D E88E040000 call 004245B0
:00424122 8BC8 mov ecx, eax
:00424124 E8B7890000 call 0042CAE0 <===關鍵的CALL了，F8跟進
:00424129 85C0 test eax, eax <===EAX不能為0
:0042412B 0F8457010000 je 00424288 <===關鍵跳轉，
:00424131 6A00 push 00000000
:00424133 8D4C2434 lea ecx, dword ptr [esp+34]
:00424137 E8C4020000 call 00424400
:0042413C BB02000000 mov ebx, 00000002
:00424141 8D4C2430 lea ecx, dword ptr [esp+30]
:00424145 899C2484010000 mov dword ptr [esp+00000184], ebx
:0042414C E83A220200 call 0044638B
:00424151 51 push ecx
:00424152 8BCC mov ecx, esp
:00424154 89642420 mov dword ptr [esp+20], esp
:00424158 57 push edi
:00424159 E8675A0200 call 00449BC5
:0042415E 6A01 push 00000001
:00424160 889C248C010000 mov byte ptr [esp+0000018C], bl
:00424167 E854040000 call 004245C0
:0042416C 8BC8 mov ecx, eax
:0042416E E82DCD0000 call 00430EA0
:00424173 8D4C2424 lea ecx, dword ptr [esp+24]
:00424177 E8A4F0FFFF call 00423220
:0042417C A154234700 mov eax, dword ptr [00472354]
:00424181 89442410 mov dword ptr [esp+10], eax
:00424185 8B0DF85D4700 mov ecx, dword ptr [00475DF8]
:0042418B 8D44241C lea eax, dword ptr [esp+1C]
:0042418F C684248401000005 mov byte ptr [esp+00000184], 05
:00424197 8B11 mov edx, dword ptr [ecx]
:00424199 52 push edx
:0042419A 50 push eax
:0042419B E87020FFFF call 00416210
:004241A0 83C408 add esp, 00000008

* Possible StringData Ref from Data Obj ->"\SysSet.cfg"
|
:004241A3 68640D4700 push 00470D64
.......
此處刪除一段註冊資訊儲存程式碼
.......
:0042427E E8F5230200 call 00446678
:00424283 E980000000 jmp 00424308

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042412B(C) <===這裡向上就是關鍵跳轉了
|
:00424288 A154234700 mov eax, dword ptr [00472354]
:0042428D 89442418 mov dword ptr [esp+18], eax
:00424291 C784248401000009000000 mov dword ptr [esp+00000184], 00000009
:0042429C 89442414 mov dword ptr [esp+14], eax

* Possible Reference to String Resource ID=00103: "Ⅺ?h V1.21"
|
:004242A0 6A67 push 00000067
:004242A2 8D4C2418 lea ecx, dword ptr [esp+18]
:004242A6 C68424880100000A mov byte ptr [esp+00000188], 0A
:004242AE E835670200 call 0044A9E8

* Possible Reference to String Resource ID=00137: "?
9M骼?
| <==="您的註冊姓名與註冊碼不匹配，請檢查一下重新輸入。"
:004242B3 6889000000 push 00000089
:004242B8 8D4C241C lea ecx, dword ptr [esp+1C]
:004242BC E827670200 call 0044A9E8
.......
.......

-----00424124 call 0042CAE0 關鍵的CALL了，F8跟進----------------

:0042CAE0 6AFF push FFFFFFFF
:0042CAE2 68B07D4500 push 00457DB0
:0042CAE7 64A100000000 mov eax, dword ptr fs:[00000000]
:0042CAED 50 push eax
:0042CAEE 64892500000000 mov dword ptr fs:[00000000], esp
:0042CAF5 83EC30 sub esp, 00000030
:0042CAF8 53 push ebx
:0042CAF9 55 push ebp
:0042CAFA 56 push esi
:0042CAFB 57 push edi
:0042CAFC 33FF xor edi, edi
:0042CAFE 897C2448 mov dword ptr [esp+48], edi
:0042CB02 8B4C2450 mov ecx, dword ptr [esp+50]
:0042CB06 C644241301 mov [esp+13], 01
:0042CB0B 8B41F8 mov eax, dword ptr [ecx-08]
:0042CB0E 83F803 cmp eax, 00000003
:0042CB11 0F8C74010000 jl 0042CC8B <===這裡跳了就OVER了，註冊碼長度必須大於3
:0042CB17 8B442454 mov eax, dword ptr [esp+54]
:0042CB1B 8378F801 cmp dword ptr [eax-08], 00000001
:0042CB1F 0F8C66010000 jl 0042CC8B <===這裡跳了就OVER了，註冊名長度必須大於1

* Possible StringData Ref from Data Obj ->"opq98"
|
:0042CB25 68C0144700 push 004714C0 <===感覺是黑名單
:0042CB2A 51 push ecx
:0042CB2B E830970000 call 00436260
:0042CB30 83C408 add esp, 00000008
:0042CB33 3BC7 cmp eax, edi
:0042CB35 0F8450010000 je 0042CC8B <===這裡一跳也OVER，就是黑名單了。
:0042CB3B 8B4C2450 mov ecx, dword ptr [esp+50]
:0042CB3F 8B542454 mov edx, dword ptr [esp+54]
:0042CB43 897C2414 mov dword ptr [esp+14], edi
:0042CB47 8B49F8 mov ecx, dword ptr [ecx-08]
:0042CB4A 8B42F8 mov eax, dword ptr [edx-08] <===EAX=8(假碼78787878的長度)
:0042CB4D 894C2418 mov dword ptr [esp+18], ecx <===ECX=7(註冊名的長度)
:0042CB51 8D1409 lea edx, dword ptr [ecx+ecx]
:0042CB54 3BC2 cmp eax, edx <===呵呵，註冊碼的長度就是註冊名長度的兩倍
:0042CB56 0F852F010000 jne 0042CC8B <===如果不相等，就跳向OVER了。
:0042CB5C 3BCF cmp ecx, edi
:0042CB5E 0F8E01010000 jle 0042CC65 <===這裡一跳，就是正確了。呵呵，但是不會跳的
:0042CB64 8A5C2450 mov bl, byte ptr [esp+50]
:0042CB68 EB04 jmp 0042CB6E <===程式從這裡跳走

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC5F(C) <===這裡是個外部迴圈
|
:0042CB6A 8B4C2418 mov ecx, dword ptr [esp+18]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB68(U)
|
:0042CB6E 8D4701 lea eax, dword ptr [edi+01]
:0042CB71 33D2 xor edx, edx
:0042CB73 3BC1 cmp eax, ecx
:0042CB75 8B442450 mov eax, dword ptr [esp+50]
:0042CB79 0F9CC2 setl dl
:0042CB7C 8A0C07 mov cl, byte ptr [edi+eax]
:0042CB7F 8BF2 mov esi, edx
:0042CB81 884C241C mov byte ptr [esp+1C], cl
:0042CB85 8D542428 lea edx, dword ptr [esp+28]
:0042CB89 8B44241C mov eax, dword ptr [esp+1C]
:0042CB8D 6A24 push 00000024 <===這是一個關鍵數值36(正好為數字10位和英文字母26位)
:0042CB8F 25FF000000 and eax, 000000FF
:0042CB94 52 push edx
:0042CB95 50 push eax
:0042CB96 89742430 mov dword ptr [esp+30], esi
:0042CB9A E8D2990000 call 00436571
***********************
<===對註冊名的奇數位進行變形處理，生成兩個數值SS1、SS2，(變形處理：取的ASC值除以24，餘數為SS1，商再除以24，餘數為SS2)，注：作者的程式設計時，設定如果兩次除以24，商還大於24的話，就出來SS3，但作為被除數AL，最大也只是FF，所以不可能出現SS3，更不可以出現SS4
***********************
:0042CB9F 83C40C add esp, 0000000C
:0042CBA2 85F6 test esi, esi
:0042CBA4 742D je 0042CBD3 <===這是對註冊名最後一位的判斷，如果是奇數，就從這裡跳走了。
:0042CBA6 8B4C2450 mov ecx, dword ptr [esp+50]
:0042CBAA 8D442434 lea eax, dword ptr [esp+34]
:0042CBAE 6A24 push 00000024
:0042CBB0 50 push eax
:0042CBB1 8A540F01 mov dl, byte ptr [edi+ecx+01]
:0042CBB5 88542428 mov byte ptr [esp+28], dl
:0042CBB9 8B4C2428 mov ecx, dword ptr [esp+28]
:0042CBBD 81E1FF000000 and ecx, 000000FF
:0042CBC3 51 push ecx
:0042CBC4 E8A8990000 call 00436571 <===對註冊名的偶數位進行變形處理，生成兩個數值SD1、SD2，(變形處理：取的ASC值除以24，餘數為SD1，商再除以24，餘數為SD2)
:0042CBC9 83C40C add esp, 0000000C
:0042CBCC BD04000000 mov ebp, 00000004
:0042CBD1 EB05 jmp 0042CBD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CBA4(C)
|
:0042CBD3 BD02000000 mov ebp, 00000002 <===到這裡說明最後一位是奇數

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CBD1(U)
|
:0042CBD8 33F6 xor esi, esi
:0042CBDA 85ED test ebp, ebp
:0042CBDC 7E78 jle 0042CC56
:0042CBDE 8A4C2428 mov cl, byte ptr [esp+28]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC54(C) <===這裡是個內部迴圈，共四次，就註冊名的兩個字元生成的4位數值，進行不同變換，以生成真註冊碼的4位值。
|
:0042CBE2 83FE03 cmp esi, 00000003
:0042CBE5 7739 ja 0042CC20
:0042CBE7 FF24B5C4CC4200 jmp dword ptr [4*esi+0042CCC4]
<===這裡由於ESI值的不同產生不同的四次跳轉
:0042CBEE 8A5C2429 mov bl, byte ptr [esp+29]<===第一次跳到這裡，處理SS1
:0042CBF2 EB2C jmp 0042CC20
:0042CBF4 8B442424 mov eax, dword ptr [esp+24]<===第二次跳到這裡，處理SD1
:0042CBF8 85C0 test eax, eax <===[esp+24]是一個標誌位，如果註冊名最後一位不是偶數位就跳走了。因為不可能有SD1和SD2了。
:0042CBFA 7406 je 0042CC02 <===如果EAX為0，則這裡跳走。
:0042CBFC 8A5C2434 mov bl, byte ptr [esp+34]
:0042CC00 EB1E jmp 0042CC20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CBFA(C)
|
:0042CC02 8AD9 mov bl, cl　<===如果最後一位是奇數位，則來到這裡，就直接用SS2(商)了
:0042CC04 EB1A jmp 0042CC20
:0042CC06 0FBED1 movsx edx, cl <===第三次跳到這裡，處理SS2
:0042CC09 6A01 push 00000001
:0042CC0B 52 push edx
:0042CC0C E8CFFBFFFF call 0042C7E0 <===因為有了它，所以在真正註冊碼的3的倍數位都是大寫的英文字母
:0042CC11 8A4C2430 mov cl, byte ptr [esp+30]
:0042CC15 83C408 add esp, 00000008
:0042CC18 8AD8 mov bl, al
:0042CC1A EB04 jmp 0042CC20
:0042CC1C 8A5C2435 mov bl, byte ptr [esp+35] <===第四次跳到這裡，處理SD2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CBE5(C), :0042CBF2(U), :0042CC00(U), :0042CC04(U), :0042CC1A(U)
|
:0042CC20 84DB test bl, bl
:0042CC22 7519 jne 0042CC3D <===如果BL不為0，則跳走
:0042CC24 8A442413 mov al, byte ptr [esp+13] <===BL為0，則來到這裡
:0042CC28 8AD8 mov bl, al
:0042CC2A F6DB neg bl
:0042CC2C 1ADB sbb bl, bl
:0042CC2E 80E3E0 and bl, E0
:0042CC31 80C368 add bl, 68
:0042CC34 84C0 test al, al
:0042CC36 0F94C0 sete al
:0042CC39 88442413 mov byte ptr [esp+13], al

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC22(C)
|
:0042CC3D 8B542414 mov edx, dword ptr [esp+14]
:0042CC41 8BC2 mov eax, edx
:0042CC43 42 inc edx
:0042CC44 89542414 mov dword ptr [esp+14], edx
:0042CC48 8B542454 mov edx, dword ptr [esp+54]
:0042CC4C 381C10 cmp byte ptr [eax+edx], bl
<===[eax+edx]為依次取出的註冊碼值，BL為註冊名的字元算出的正確註冊碼(僅一位)
:0042CC4F 753A jne 0042CC8B <===這裡一跳就OVER了。
:0042CC51 46 inc esi
:0042CC52 3BF5 cmp esi, ebp
:0042CC54 7C8C jl 0042CBE2
　　<===這裡是一個內部迴圈，取兩位註冊名的字元生成4位註冊碼

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CBDC(C)
|
:0042CC56 8B442418 mov eax, dword ptr [esp+18]
:0042CC5A 83C702 add edi, 00000002
:0042CC5D 3BF8 cmp edi, eax
:0042CC5F 0F8C05FFFFFF jl 0042CB6A <===這裡是一個外部迴圈

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CB5E(C)
|
:0042CC65 8D4C2450 lea ecx, dword ptr [esp+50]
:0042CC69 C644244800 mov [esp+48], 00
:0042CC6E E8DDD10100 call 00449E50
:0042CC73 8D4C2454 lea ecx, dword ptr [esp+54]
:0042CC77 C7442448FFFFFFFF mov [esp+48], FFFFFFFF
:0042CC7F E8CCD10100 call 00449E50
:0042CC84 B801000000 mov eax, 00000001 <===這裡是關鍵的標誌賦值，一定要經過
:0042CC89 EB21 jmp 0042CCAC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042CB11(C), :0042CB1F(C), :0042CB35(C), :0042CB56(C), :0042CC4F(C)
<===這裡5個，都是錯誤的跳轉
:0042CC8B 8D4C2450 lea ecx, dword ptr [esp+50]
:0042CC8F C644244800 mov [esp+48], 00
:0042CC94 E8B7D10100 call 00449E50
:0042CC99 8D4C2454 lea ecx, dword ptr [esp+54]
:0042CC9D C7442448FFFFFFFF mov [esp+48], FFFFFFFF
:0042CCA5 E8A6D10100 call 00449E50
:0042CCAA 33C0 xor eax, eax <===EAX被清0，也就是失敗了。

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CC89(U)
|
:0042CCAC 8B4C2440 mov ecx, dword ptr [esp+40]
:0042CCB0 5F pop edi
:0042CCB1 5E pop esi
:0042CCB2 5D pop ebp
:0042CCB3 5B pop ebx
:0042CCB4 64890D00000000 mov dword ptr fs:[00000000], ecx
:0042CCBB 83C43C add esp, 0000003C
:0042CCBE C20800 ret 0008

---------0042CC0C call 0042C7E0--對SS2進行處理---------------
:0042C7E0 81EC20010000 sub esp, 00000120
:0042C7E6 BA37000000 mov edx, 00000037
:0042C7EB 56 push esi
:0042C7EC 89542420 mov dword ptr [esp+20], edx
:0042C7F0 899424B0000000 mov dword ptr [esp+000000B0], edx
:0042C7F7 8B94242C010000 mov edx, dword ptr [esp+0000012C]
:0042C7FE B938000000 mov ecx, 00000038
:0042C803 B839000000 mov eax, 00000039
:0042C808 BE36000000 mov esi, 00000036
:0042C80D 894C2424 mov dword ptr [esp+24], ecx
:0042C811 89442428 mov dword ptr [esp+28], eax
:0042C815 898C24B4000000 mov dword ptr [esp+000000B4], ecx
:0042C81C 898424B8000000 mov dword ptr [esp+000000B8], eax
:0042C823 C744240430000000 mov [esp+04], 00000030
.......
此處略去一段產生規則的碼錶，作者真有心一個一個的做，我這裡卻省了;-)
.......
:0042CA92 C78424200100005A000000 mov dword ptr [esp+00000120], 0000005A
:0042CA9D 33C0 xor eax, eax <===EAX被清0
:0042CA9F 8D0CD2 lea ecx, dword ptr [edx+8*edx] <===ECX=9
:0042CAA2 8BB42428010000 mov esi, dword ptr [esp+00000128] <===這個值十分的關鍵，它就是SS2
:0042CAA9 C1E104 shl ecx, 04 <===ECX=90
:0042CAAC 8D4C0C04 lea ecx, dword ptr [esp+ecx+04]<===[esp+ecx+04]就是一個碼錶的開始，這個碼錶是0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(英文字母是大寫)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CABB(C)
|
:0042CAB0 3B31 cmp esi, dword ptr [ecx]<===ESI就是SS2，(由於ASC碼值最大也就是FF，所以SS2的範圍在1-7之間)在新碼錶裡找位數。
:0042CAB2 7409 je 0042CABD
:0042CAB4 40 inc eax <===EAX遞增，步進為1
:0042CAB5 83C104 add ecx, 00000004 <===因為碼錶的數是每隔4位放一個，所以這裡ECX也依次加4
:0042CAB8 83F824 cmp eax, 00000024 <===保證EAX不會超出36。
:0042CABB 7CF3 jl 0042CAB0 <===呵呵，這裡構成一小迴圈

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042CAB2(C)
|
:0042CABD 8D14D2 lea edx, dword ptr [edx+8*edx] <===EDX=9
:0042CAC0 C1E202 shl edx, 02 <===EDX=24(十進位制就是36，正好和碼錶個數相同)
:0042CAC3 2BD0 sub edx, eax <===EAX就是倒數位，24-EAX就是正數的位數
:0042CAC5 5E pop esi
:0042CAC6 8B84948C000000 mov eax, dword ptr [esp+4*edx+0000008C]<===因為碼錶是每隔4位放一個數，所以4*edx，就表示EDX就是碼錶中的第幾位數。所以得出的結論是EAX就是新碼錶，倒數第SS2位(1-7位)
:0042CACD 81C420010000 add esp, 00000120
:0042CAD3 C3 ret

---------------------------------------------------------------------
4、演算法分析：---型別註冊: f(註冊名)=註冊碼---
a、依次取出註冊名的兩個字元(一箇中文為兩個字元)，奇數位除以24(10進位制36)，餘數為SS1，商為SS2。偶數位也除以24(10進位制36)，餘數為SD1，商為SD2。
b、將SS2單獨取出，對字串"STUVWXYZ"取倒數SS2+1位數值，如果SS2為0，那麼新的SS2就是Z；如果SS2是3，則新的SS2就是W了
c、這樣就得出真註冊碼的4位，SS1 SD2 SS2(新) SD1，依此類推。如果註冊名的最後一位是奇數位的話，那麼SS2就不做任何處理(b步驟)，直接用了。

5、-------VB6.0製作的序號產生器原碼(只能用英文註冊)-----------
Private Sub Command1_Click()
strtmp = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
strtmp1 = "0123456789abcdefghijklmnopqrstuvwxyz"
startin = Text1.Text
nlen = Len(startin)
For i = 1 To nlen
z1 = Asc(Mid(startin, i, 1)) '奇數位字元處理
ss1 = Mid(strtmp1, (z1 Mod 36) + 1, 1)
ss2x = Int(z1 / 36)
ss2 = Mid(strtmp, 36 - ss2x, 1)
i = i + 1
If i <= nlen Then
z2 = Asc(Mid(startin, i, 1)) '偶數位字元處理
sd1 = Mid(strtmp1, (z2 Mod 36) + 1, 1)
sd2 = CStr(Int(z2 / 36))
Else
sd1 = ""
sd2 = ""
ss2=cstr(ss2x)
End If
laststr = laststr + ss1 + sd2 + ss2 + sd1
Next i

Text2.Text = laststr
End Sub

6、註冊資訊儲存在檔案SysSet.cfg：
(略)
[Reg]
RegName=newlaos
RegCode=XXXXXXXXXXXXXX (此處即為真註冊碼，為維護作者利益=>隱)

俠客系統修改器1.21

相關文章